CVE-2026-21131CWE-276

CVE-2026-21131

published October 12, 2026

CVSS
2.1
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00105 · 1.0th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-10-12T09:17Z
References (1)
https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=10 · [email protected]
EPSS history
Timeline
  • 13 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 12 OCT 04:57Z
    Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on…
    cvelistv5
  • 12 OCT 04:57Z
    Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on…
    cvelistv5